Special Fields
Predefined $-prefixed columns and time fields available in every Berserk table.
Special fields are predefined columns available in every table. The $-prefixed names are reserved — user-defined columns cannot use them.
$raw — the property bag
Every table has a $raw column, a dynamic property bag containing the full ingested record. Use it to access fields that aren't part of the schema.
default | extend custom_field = $raw.my_custom_propertyIn permissive mode, which every query runs in, bare identifiers that don't match a declared column are automatically resolved against $raw. See The $raw Column.
Time fields
timestamp — domain time
The primary timestamp representing when the event occurred in the source system. This is the "business time" of the event. Type: datetime.
default | where timestamp > datetime("2024-01-01T00:00:00Z")
default | where timestamp between [now() - 2d, now() - 1d]Predicates on timestamp are extracted by the range analyzer and used to filter segments at the meta-service layer, reducing I/O.
A computed timestamp
extend timestamp = ... makes a column of the query's own under that name. Later operators read it and the output shows it, but it is not the row's own timestamp. trace-find and join-with-time bin and pair rows by the row's own: the engine reads their input in time slices of that field, and binning by a computed value would look for rows in slices that were never read for them. A computed timestamp therefore never moves a row into another within window, and their input rows need a timestamp of their own. A datatable that declares none is an error there.
ingest_time — ingestion time
The timestamp when the event entered Berserk. May lag timestamp due to processing delays, buffering, or late-arriving data. Type: datetime.
default | where ingest_time > datetime("2024-01-01T00:00:00Z")
// Find events whose ingestion lagged the source by more than 1 hour
default | where ingest_time - timestamp > 1hingest_time predicates also drive segment pruning, just like timestamp.
start_time and end_time — trace span fields
For distributed tracing data, start_time and end_time are the span boundaries. The timestamp column on a trace is an independent copy of end_time (the span completion time). Both fields are datetime.
traces | extend duration = end_time - start_time | where duration > 1sJoin column qualifiers
After a join, $left.<field> and $right.<field> disambiguate columns from each side of the join. They are syntactic qualifiers, not standalone fields — they must be followed by a field name.
table1
| join table2 on common_key
| extend left_value = $left.column_a
| extend right_value = $right.column_b
| extend left_dynamic = $left.$raw.custom_prop$left or $right used alone is an error.
When joins follow each other, each adds one $right. to the right columns it renames: the second join in a row writes $right.$right.<field>, read as ['$right.$right.<field>']. To keep names short, give the columns you keep your own names with project.